VulnerabilityBleeping Computer
9.8 — CRITICAL
CISA warns admins to patch actively exploited SharePoint flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned Tuesday that attackers are actively exploiting three vulnerabilities to hack Internet-exposed on-premises SharePoint Server instances. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting three vulnerabilities in Microsoft SharePoint Server instances, which affect all supported self-hosted versions, including the latest on-premises version with a continuous update model.
⚙️Technical Details
Affected Systems
Microsoft SharePoint Server instances
Attack Vectors
NETWORK
💥Impact Assessment
Severity: CRITICAL
Who Is at Risk
Internet-exposed Microsoft SharePoint servers, including over 800 unpatched instances
🛡️Recommended Actions
1Apply Microsoft's latest patches to affected servers
2Enable Windows Antimalware Scan Interface (AMSI) integration for SharePoint web applications and use Microsoft Defender Antivirus (MDAV) detections
3Hunt for and remediating intrusion artifacts before rotating IIS machine keys
📦Affected Products
Microsoft Sharepoint Server
🔐NVD Verified DataVERIFIED
CVE-2026-32201 ↗CVSS 6.5 — MEDIUM
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NWeaknesses
CWE-20
Affected Products (CPE)
Microsoft Sharepoint Server
CVE-2026-45659 ↗CVSS 8.8 — HIGH
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-502
Affected Products (CPE)
Microsoft Sharepoint Server
CVE-2026-56164 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-306
Affected Products (CPE)
Microsoft Sharepoint Server
CVE-2026-55040 ↗CVSS 9.1 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NWeaknesses
CWE-1390
CVE-2026-58644 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-502
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.